---
title: "Keep secrets out of email · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/email-security/no-secrets-in-email
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep secrets out of email

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Email security](https://agentwranglers.se/playbook/email/email-security)
- Rule: Never send passwords, full card numbers, ID numbers or API keys by email. Email is stored in many places and is hard to delete.
- How: Show only the last four digits of a card or account. Send a link to a signed-in page for anything sensitive. If you must send a temporary credential, make it single use and short lived.
- Check: Search a sample of sent messages for card number and key patterns. None appears in full.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/no-secrets-in-email`.

- Previous: [Make sign-in and reset links single-use and short-lived](https://agentwranglers.se/playbook/email/email-security/sign-in-links)
- Next: [Avoid risky attachments](https://agentwranglers.se/playbook/email/email-security/safe-attachments)
- [Email security](https://agentwranglers.se/playbook/email/email-security)